Re: IP over DNS.

[Ryan Russell <ryan () securityfocus com>]

On Tue, 12 Sep 2000, Darren Reed wrote:

> The biggest problem is that without doing bad things to
> DNS*, you can't stop this from being setup without putting
> in place a full proxy based firewall.  Why ? In order for
> a packet filter firewall to work, hosts inside need to be
> able to get outside address information and that's what
> we need to deny people in order to stop the above.

You mean a non-transparent proxy?  That's the only type that will help
with this.  A transparent proxt will have the same problem.  You could
make a non-transparent SPF if you wanted, but that would be a pretty
strange thing to do.

It's a bit of a moot point though... most everyone here knows that you can
tunnel any protocol over any other, as long as timing is not
critical.  HTTP makes a much more universal tunnel.  You can buy VPNs that
will run over HTTP, such as VTCP/Secure from Infoexpress.

                                                Ryan


_______________________________________________
Firewall-wizards mailing list
Firewall-wizards () nfr net
http://www.nfr.net/mailman/listinfo/firewall-wizards